# Testing checklist: insurance app

Source: https://howtotestaproduct.com/how-to-test/insurtech-app/
Generated: 2026-10-07. Licence: CC BY 4.0.

- [ ] 1. release smoke tests
  - Done when: After each release, a test customer gets a quote, binds a policy, pays the first premium and sees the policy documents in the app.
  - Risks: money-loss
  - Tool class: browser automation. Usually run by: QA engineer.
- [ ] 2. data integrity and migration testing
  - Done when: After each rating data load, a reconciliation report shows no renewal whose premium differs from a recalculation with the filed rates.
  - Risks: data-corruption, money-loss, wrong-decisions
  - Tool class: data validation. Usually run by: QA engineer.
- [ ] 3. unit tests
  - Done when: For a reviewed set of test drivers and homes, the rating engine returns the same premium as the filed rate tables, factor by factor.
  - Risks: data-corruption, money-loss
  - Tool class: unit framework. Usually run by: developer.
- [ ] 4. payment and money-flow testing
  - Done when: In the sandbox, a mid-term cancellation refunds the unearned premium once to the original card, and a declined renewal payment does not mark the policy as paid.
  - Risks: money-loss
  - Tool class: API client. Usually run by: QA engineer.
- [ ] 5. penetration testing
  - Done when: An external tester cannot extract licence numbers from the quote or agent tools, and the agent portal refuses login without a second factor.
  - Risks: data-breach, regulatory-penalty
  - Tool class: proxy. Usually run by: external lab.
- [ ] 6. compliance checks
  - Done when: A reviewer finds a dated record of bias and accuracy testing for each model used in pricing or claims, and a sign-off before each model change.
  - Risks: regulatory-penalty, wrong-decisions
  - Tool class: test management. Usually run by: product manager.
- [ ] 7. integration tests
  - Done when: An insurance score or vehicle record returned by the data vendor lands in the policy record with the same value and tier the vendor sent.
  - Risks: data-corruption
  - Tool class: API client. Usually run by: developer.
- [ ] 8. end-to-end functional tests
  - Done when: Typing a stranger's name and birth date into the quote form returns no driver's license number or household driver details on any screen or response.
  - Risks: data-breach
  - Tool class: browser automation. Usually run by: QA engineer.
- [ ] 9. security scanning
  - Done when: The latest scan of the public quote tool, the agent portal and their APIs shows no open finding that exposes licence numbers or policy data.
  - Risks: data-breach
  - Tool class: DAST scanner. Usually run by: security specialist.